News for hackers. Stuff that matters.

A comment on Experian’s credit freeze security is still a joke. Parent comment

Re:Experian’s credit freeze security is still a joke by ncallaway on Monday April 26, 2021 @09:38PM (#26950775)
Security questions are typically stored with a reversible encryption so they can be used by CS agents.

Security questions are not a password.

[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by MereInterest on Monday April 26, 2021 @10:04PM (#26951011)
Which is why security questions are a horrible idea. What good does it do to have your nicely salted and hashed password when the answers to the security questions are available in plain text and get you access to the account.
[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by tinus_hn on Tuesday April 27, 2021 @04:54AM (#26953598)
They are just equivalent to a password, as knowing the answers allows you to reset the password.
[ Parent | on HN ]